agent-passport-system-mcp 3.2.2 → 3.2.4

package/README.md

@@ -69,7 +69,7 @@ Or for remote SSE:
 ```
 </details>
 
-## Tools (154)
+## Tools (150)
 
 ### Identity (Layer 1) — 5 tools
 
@@ -209,14 +209,13 @@ Layer 1 — Agent Passport Protocol (Ed25519 identity)
 
 ## Recognition
 
-- Integrated into [Microsoft agent-governance-toolkit](https://github.com/microsoft/agent-governance-toolkit) (PR #274)
+- Three contribution PRs merged into the Microsoft Agent Governance Toolkit by a Microsoft maintainer (#274, #598, #1328)
 - Public comment submitted to NIST NCCoE on AI Agent Identity and Authorization standards
 - Collaboration with IETF DAAP draft author on delegation spec
-- Endorsed by Garry Tan (CEO, Y Combinator)
 
 ## Links
 
-- npm SDK: [agent-passport-system](https://www.npmjs.com/package/agent-passport-system) (v2.6.0, 3,791 tests)
+- npm SDK: [agent-passport-system](https://www.npmjs.com/package/agent-passport-system) (v2.9.0, 3,881 tests)
 - Python SDK: [agent-passport-system](https://pypi.org/project/agent-passport-system/) (v2.4.0a3 pre-release; v2.3.0 stable)
 - Go SDK: [agent-passport-go](https://pkg.go.dev/github.com/aeoess/agent-passport-go) (v0.2.0-alpha.1; `go get github.com/aeoess/agent-passport-go@v0.2.0-alpha.1`)
 - Paper (Social Contract): [doi.org/10.5281/zenodo.18749779](https://doi.org/10.5281/zenodo.18749779)

package/build/__tests__/capability-expiry.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/__tests__/capability-expiry.test.js

@@ -0,0 +1,36 @@
+// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
+// Regression: a capability SinkChallenge carries a signed expires_at that no
+// verifier enforced, so an expired permit stayed redeemable forever.
+// verifySinkChallenge / verifyChallengeReceipt now reject an expired challenge.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { generateKeyPair } from "agent-passport-system";
+import { issueSinkChallenge } from "../capabilityToken/sinkChallenge.js";
+import { verifySinkChallenge } from "../capabilityToken/verify.js";
+const action = {
+    kind: "fs.write",
+    target: "file:///tmp/aps-capability-expiry-test.txt",
+    parameters: { content_length: 1 },
+    resource_version: "v1",
+};
+test("verifySinkChallenge accepts a live challenge and rejects an expired one", () => {
+    const sink = generateKeyPair();
+    const issued = new Date("2026-01-01T00:00:00.000Z");
+    const challenge = issueSinkChallenge({
+        sink_id: sink.publicKey,
+        subject_id: "subject-1",
+        action,
+        sink_key: sink,
+        validity_seconds: 60,
+        now: issued,
+    });
+    // 30s after issue: within the 60s validity.
+    assert.equal(verifySinkChallenge(challenge, sink.publicKey, issued.getTime() + 30_000).ok, true);
+    // 120s after issue: past expiry.
+    const expired = verifySinkChallenge(challenge, sink.publicKey, issued.getTime() + 120_000);
+    assert.equal(expired.ok, false);
+    assert.match(expired.reason, /expired/);
+    // A valid signature with a wrong key still fails for the signature reason, not expiry.
+    const other = generateKeyPair();
+    assert.equal(verifySinkChallenge(challenge, other.publicKey, issued.getTime() + 30_000).ok, false);
+});

package/build/__tests__/capability-token-e2e.test.js

@@ -379,3 +379,41 @@ test("Hash stability: re-issuing M1 with the same nonce + clock yields the same
     assert.equal(challengeHash(a), challengeHash(b));
     assert.equal(canonicalWithoutSignature(a, "sink_signature"), canonicalWithoutSignature(b, "sink_signature"));
 });
+// Regression (round-3, item 4): the gateway M3 mint must fail closed on an expired challenge.
+// expires_at is signed into the M1 challenge, so minting a PERMIT after it would let a stale
+// challenge be redeemed. mintChallengeReceipt now downgrades an expired permit to a deny.
+test("M3 mint downgrades a permit over an expired challenge to a deny", () => {
+    const actors = setupActors();
+    const challenge = issueSinkChallenge({
+        sink_id: actors.sink.publicKey,
+        subject_id: actors.subject.publicKey,
+        action: sampleAction(),
+        sink_key: actors.sink,
+    });
+    const request = buildEvaluationRequest({
+        challenge,
+        delegation_chain: sampleDelegationChain(actors),
+        authority_token: sampleAuthorityToken(),
+        freshness_beacon: sampleFreshnessBeacon(actors),
+        subject_key: actors.subject,
+    });
+    // Mint with a clock far past the challenge's expires_at: permit must become deny.
+    const expired = mintChallengeReceipt({
+        request,
+        decision: "permit",
+        policy_digest: "policy-bundle-sha256-v0.1-fixture",
+        gateway_key: actors.gateway,
+        now: new Date("3000-01-01T00:00:00Z"),
+    });
+    assert.equal(expired.decision, "deny");
+    assert.equal(expired.deny_reason, "challenge_expired");
+    assert.equal(expired.authority_token_preimage, undefined);
+    // Control: minting within the validity window still permits.
+    const fresh = mintChallengeReceipt({
+        request,
+        decision: "permit",
+        policy_digest: "policy-bundle-sha256-v0.1-fixture",
+        gateway_key: actors.gateway,
+    });
+    assert.equal(fresh.decision, "permit");
+});

package/build/capabilityToken/challengeReceipt.js

@@ -17,23 +17,34 @@ const CLOSED_DENY_CLAIMS = {
     effect_occurred: "unresolved",
 };
 export function mintChallengeReceipt(opts) {
+    const evaluatedAt = (opts.now ?? new Date()).toISOString();
+    // Fail closed on an expired challenge: expires_at is signed into the challenge, so the gateway
+    // must not mint a PERMIT after it. Downgrade an expired permit to a deny. nowMs defaults to the
+    // wall clock; an unparseable expires_at is treated as expired.
+    const nowMs = (opts.now ?? new Date()).getTime();
+    const expMs = Date.parse(opts.request.challenge.expires_at);
+    let decision = opts.decision;
+    let denyReason = opts.deny_reason;
+    if (decision === "permit" && (!Number.isFinite(expMs) || nowMs > expMs)) {
+        decision = "deny";
+        denyReason = "challenge_expired";
+    }
     const cHash = opts.override_challenge_hash ?? challengeHash(opts.request.challenge);
     const claims = opts.epistemic_claims ??
-        (opts.decision === "permit" ? CLOSED_PERMIT_CLAIMS : CLOSED_DENY_CLAIMS);
-    const evaluatedAt = (opts.now ?? new Date()).toISOString();
+        (decision === "permit" ? CLOSED_PERMIT_CLAIMS : CLOSED_DENY_CLAIMS);
     const chainRoot = opts.omit_delegation_chain_root
         ? ""
         : opts.override_delegation_chain_root ?? opts.request.delegation_chain_root;
     const unsigned = {
         type: "aps.capability.v1.ChallengeReceipt",
         challenge_hash: cHash,
-        decision: opts.decision,
-        ...(opts.decision === "deny" && opts.deny_reason
-            ? { deny_reason: opts.deny_reason }
+        decision: decision,
+        ...(decision === "deny" && denyReason
+            ? { deny_reason: denyReason }
             : {}),
         delegation_chain_root: chainRoot,
         delegation_depth: opts.request.delegation_depth,
-        ...(opts.decision === "permit"
+        ...(decision === "permit"
             ? { authority_token_preimage: opts.request.authority_token.token_preimage }
             : {}),
         evaluated_at: evaluatedAt,

package/build/capabilityToken/verify.d.ts

@@ -5,15 +5,15 @@ export type VerifyResult = {
     ok: false;
     reason: string;
 };
-export declare function verifySinkChallenge(challenge: SinkChallenge, sinkPublicKey: string): VerifyResult;
-export declare function verifyAuthorityEvaluationRequest(request: AuthorityEvaluationRequest, subjectPublicKey: string, sinkPublicKey: string): VerifyResult;
+export declare function verifySinkChallenge(challenge: SinkChallenge, sinkPublicKey: string, nowMs?: number): VerifyResult;
+export declare function verifyAuthorityEvaluationRequest(request: AuthorityEvaluationRequest, subjectPublicKey: string, sinkPublicKey: string, nowMs?: number): VerifyResult;
 export interface VerifyChallengeReceiptOptions {
     receipt: ChallengeReceipt;
     expected_challenge: SinkChallenge;
     expected_delegation_chain_root: string;
     gateway_public_key: string;
 }
-export declare function verifyChallengeReceipt(opts: VerifyChallengeReceiptOptions): VerifyResult;
+export declare function verifyChallengeReceipt(opts: VerifyChallengeReceiptOptions, nowMs?: number): VerifyResult;
 export interface VerifyEffectReceiptOptions {
     receipt: EffectReceipt;
     challenge_receipt: ChallengeReceipt;

package/build/capabilityToken/verify.js

@@ -5,24 +5,38 @@ import { verify } from "agent-passport-system";
 import { canonicalWithoutSignature } from "./canonical.js";
 import { challengeHash } from "./sinkChallenge.js";
 import { challengeReceiptHash } from "./challengeReceipt.js";
-export function verifySinkChallenge(challenge, sinkPublicKey) {
+export function verifySinkChallenge(challenge, sinkPublicKey, nowMs = Date.now()) {
     const payload = canonicalWithoutSignature(challenge, "sink_signature");
-    return verify(payload, challenge.sink_signature, sinkPublicKey)
-        ? { ok: true }
-        : { ok: false, reason: "sink_signature invalid" };
+    if (!verify(payload, challenge.sink_signature, sinkPublicKey)) {
+        return { ok: false, reason: "sink_signature invalid" };
+    }
+    // Enforce expiry. expires_at is signed and propagated but was never checked, so an expired
+    // capability challenge stayed redeemable forever. nowMs defaults to the wall clock so the check
+    // is enforced by default and cannot fail open; tests inject a fixed clock.
+    const expMs = Date.parse(challenge.expires_at);
+    if (!Number.isFinite(expMs) || nowMs > expMs) {
+        return { ok: false, reason: "challenge expired" };
+    }
+    return { ok: true };
 }
-export function verifyAuthorityEvaluationRequest(request, subjectPublicKey, sinkPublicKey) {
+export function verifyAuthorityEvaluationRequest(request, subjectPublicKey, sinkPublicKey, nowMs = Date.now()) {
     const payload = canonicalWithoutSignature(request, "subject_signature");
     if (!verify(payload, request.subject_signature, subjectPublicKey)) {
         return { ok: false, reason: "subject_signature invalid" };
     }
-    return verifySinkChallenge(request.challenge, sinkPublicKey);
+    return verifySinkChallenge(request.challenge, sinkPublicKey, nowMs);
 }
-export function verifyChallengeReceipt(opts) {
+export function verifyChallengeReceipt(opts, nowMs = Date.now()) {
     const payload = canonicalWithoutSignature(opts.receipt, "gateway_signature");
     if (!verify(payload, opts.receipt.gateway_signature, opts.gateway_public_key)) {
         return { ok: false, reason: "gateway_signature invalid" };
     }
+    // Reject a receipt whose underlying challenge has expired. expires_at was never enforced, so an
+    // expired capability stayed redeemable. nowMs defaults to the wall clock (enforced by default).
+    const expMs = Date.parse(opts.expected_challenge.expires_at);
+    if (!Number.isFinite(expMs) || nowMs > expMs) {
+        return { ok: false, reason: "challenge expired" };
+    }
     const expectedHash = challengeHash(opts.expected_challenge);
     if (opts.receipt.challenge_hash !== expectedHash) {
         return {

package/build/index.js

@@ -2309,13 +2309,21 @@ server.tool("commerce_preflight", "Run preflight checks before a purchase. Valid
         platform: 'node',
         models: ['mcp'],
     });
-    // Look up or create commerce delegation using actual scope/spend
-    const commerceDel = createCommerceDelegation({
-        agentId: args.agent_id,
-        delegationId: args.delegation_id,
-        spendLimit: actualSpendLimit,
-        approvedMerchants: [], // Empty = all merchants allowed
-    });
+    // Look up or create commerce delegation using actual scope/spend.
+    // Reflect spend already recorded on the session delegation instead of the hardcoded 0 that
+    // createCommerceDelegation returns, so the spend gate is not a structural no-op that always
+    // sees the full limit remaining. NOTE: nothing in the MCP yet INCREMENTS sessionDel.spentAmount
+    // (a spend-record path is a metering decision flagged for Tima), so cumulative enforcement here
+    // is only as complete as the session state that feeds it.
+    const commerceDel = {
+        ...createCommerceDelegation({
+            agentId: args.agent_id,
+            delegationId: args.delegation_id,
+            spendLimit: actualSpendLimit,
+            approvedMerchants: [], // Empty = all merchants allowed
+        }),
+        spentAmount: sessionDel?.spentAmount ?? 0,
+    };
     const result = commercePreflight({
         signedPassport: agent.passport,
         delegation: commerceDel,
@@ -2339,11 +2347,18 @@ server.tool("get_commerce_spend", "Get spend analytics for a commerce delegation
     delegation_id: z.string().describe("Commerce delegation ID"),
     spend_limit: z.number().describe("Total allowed spend"),
 }, async (args) => {
-    const commerceDel = createCommerceDelegation({
-        agentId: args.agent_id,
-        delegationId: args.delegation_id,
-        spendLimit: args.spend_limit,
-    });
+    // Report spend recorded on the session delegation instead of always reporting 0. Same caveat
+    // as commerce_preflight: nothing in the MCP yet increments sessionDel.spentAmount (metering
+    // record path flagged for Tima), so this reflects whatever the session state holds.
+    const sessionDel = state.delegations.get(args.delegation_id);
+    const commerceDel = {
+        ...createCommerceDelegation({
+            agentId: args.agent_id,
+            delegationId: args.delegation_id,
+            spendLimit: args.spend_limit,
+        }),
+        spentAmount: sessionDel?.spentAmount ?? 0,
+    };
     const summary = getSpendSummary(commerceDel);
     return {
         content: [{

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "agent-passport-system-mcp",
-  "version": "3.2.2",
+  "version": "3.2.4",
   "mcpName": "io.github.aeoess/agent-passport-mcp",
-  "description": "MCP server for the Agent Passport System — protocol-layer tools only. 150 tools (132 protocol + 10 gateway deprecation stubs). Identity, delegation, reputation, attestation, coordination, commerce, attribution primitive, attribution settlement. Tracks SDK v2.6.0 (Wave 1 accountability primitives + Phase 4.1 payment rails shipped in SDK; MCP rail-tool exposure deferred). For gateway-runtime tools (ProxyGateway, AgentContext, DataEnforcementGate), use gateway.aeoess.com REST API or pin to v3.1.x.",
+  "description": "MCP server for the Agent Passport System - protocol-layer tools only. 150 tools (132 protocol + 10 gateway deprecation stubs). Identity, delegation, reputation, attestation, coordination, commerce, attribution primitive, attribution settlement. Tracks SDK v2.9.0 (Wave 1 accountability primitives + Phase 4.1 payment rails shipped in SDK; MCP rail-tool exposure deferred). For gateway-runtime tools (ProxyGateway, AgentContext, DataEnforcementGate), use gateway.aeoess.com REST API or pin to v3.1.x.",
   "type": "module",
   "bin": {
     "agent-passport-system-mcp": "./build/bin.js",
@@ -54,7 +54,8 @@
     "zod": "^3.25.76"
   },
   "overrides": {
-    "fast-uri": ">=3.1.2"
+    "fast-uri": ">=3.1.2",
+    "hono": "^4.12.27"
   },
   "devDependencies": {
     "@types/node": "^22.19.19",